fix: harden Codex auto-resolve review guard by BigSimmo · Pull Request #445 · BigSimmo/Database

BigSimmo · 2026-07-09T11:16:23Z

Summary

keep Codex auto-resolve dedupe scoped to the PR instead of head SHA
skip review-thread replies and auto-resolve request comments to avoid self-trigger loops
narrow AGENTS instructions to actionable Codex findings for the current PR head
make pure-review ledger updates opt-in instead of automatic mutations
add a CI/static guard to prevent reintroducing SHA-scoped dedupe or broad triggers

Verification

npm run check:codex-autofix-workflow
npx prettier --check .github/workflows/codex-autofix-review-comments.yml .github/workflows/ci.yml AGENTS.md docs/codex-review-protocol.md scripts/check-codex-autofix-workflow.mjs package.json
git diff --check

Notes

Preserved unrelated dirty local files in the primary worktree; the pushed commit was replayed through a clean detached worktree at the remote branch head.

…ft manifest

…ithout GHAS

… claude/llm-pipeline-review

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

…20260708160001

- Defer embedding until after text/document fast paths and coverage gate - Rehydrate cached document metadata in attachDocumentRankingMetadata - Load env-dependent script imports after loadEnvConfig in seed/reindex scripts - Harden registry corpus: shared identity, medication tags, rollback, detail hrefs - Route registry citations to detail pages; handle registry rows in signed-url API - Prioritize safety warnings over registry info; preserve stale registry labels - Guard OCR repair against dropping isolated single-letter clinical tokens - Update skill docs, changelog dedup, CI Supabase setup-cli@v3 Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

- Backfill NULL document_images.index_generation_id during re-stamp - Count globally forced embedding eval cases in retrieval summaries Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

Treat NULL document_images.index_generation_id as stale even when JSON metadata already matches the committed generation, and propagate global --force-embedding into eval reporting/validation so index-unit-vector runs count forced cases correctly. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

… codex/pr433-fix # Conflicts: # .cursor/skills/supabase-postgres-best-practices/CHANGELOG.md # .cursor/skills/supabase-postgres-best-practices/references/security-rls-performance.md # scripts/reindex-image-generation-metadata.ts # src/lib/differential-seed.ts # src/lib/document-index-units.ts # src/lib/medication-seed.ts # src/lib/rag.ts # src/lib/registry-corpus.ts # src/lib/registry-seed.ts # src/lib/source-governance.ts # src/lib/source-metadata.ts # supabase/migrations/20260708160000_retrieval_owner_matches_fail_closed.sql # supabase/migrations/20260708160001_retrieval_owner_matches_fail_closed.sql # supabase/migrations/20260708161000_retrieval_owner_matches_fail_closed.sql # tests/document-index-units.test.ts # tests/registry-corpus.test.ts # tests/source-governance.test.ts

… codex/pr433-fix

PR #433 preview branch recorded 20260708160000 before the file was removed, causing remote migration versions not found in local migrations directory. Keep a no-op stub for history sync; transactional index DDL stays on 170000. Co-authored-by: Cursor <cursoragent@cursor.com>

… codex/pr433-fix

* fix(rag): finish registry re-embed and quality routing * fix: resolve merge conflicts with claude/llm-pipeline-review --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

… claude/llm-pipeline-review # Conflicts: # tests/rag-routing.test.ts

coderabbitai · 2026-07-09T11:16:30Z

📝 Walkthrough

Walkthrough

Adds try/catch error handling for 403 responses when listing PR comments in a Codex autofix workflow, introduces a validation script and CI step guarding that workflow's structure, and updates AGENTS.md/docs to scope auto-resolve requests to actionable findings and restrict branch-review-ledger updates during pure reviews.

Changes

Codex autofix workflow hardening and guard

Layer / File(s)	Summary
403 error handling for comment listing `.github/workflows/codex-autofix-review-comments.yml`	Wraps `issues.listComments` pagination in try/catch; 403 responses log a warning and return early, other errors are re-thrown; minor blank-line formatting near comment-creation error handling.
Workflow guard script and CI wiring `scripts/check-codex-autofix-workflow.mjs`, `package.json`, `.github/workflows/ci.yml`	Adds a script validating forbidden trigger patterns and required concurrency/marker scoping and resolve-skip guard in the autofix workflow file; wires it as `check:codex-autofix-workflow` npm script and adds a "Codex auto-resolve workflow guard" CI verify step.
AGENTS.md auto-resolve scoping update `AGENTS.md`	Updates the automatic resolve trigger and primary PR command text to scope Codex resolve requests to actionable findings for the triggering PR/head instead of resolving all review comments.
Branch review ledger and protocol mutation rules `docs/branch-review-ledger.md`, `docs/codex-review-protocol.md`	Adds a new ledger document describing lookup procedure and record schema; updates mutation rules to prohibit ledger updates during pure review unless explicitly requested, instead suggesting the ledger row in the response.

Estimated code review effort: 2 (Simple) | ~12 minutes

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Verification Claims	❌ Error	FAIL: The PR description/summary use vague verification labels (“parse check: passed”) instead of explicit “Ran : passed” wording.	Reword every verification note to an exact command/check plus result, e.g. “Ran npm run X: passed” or “Not run: reason.”
Docstring Coverage	⚠️ Warning	Docstring coverage is 2.00% which is insufficient. The required threshold is 70.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (9 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Generated And Sensitive Files	✅ Passed	No committed secrets, tokens, keys, .env files, caches, or build artifacts were added; the PR only changes docs, workflow YAML, package.json, and one validation script.
Risky Git Or Deployment Actions	✅ Passed	No changed file recommends force-push, hard reset, destructive clean, branch deletion, or deployment without confirmation; the edits add guardrails and safe-only guidance.
Supabase Project And Schema Safety	✅ Passed	No Supabase project refs or schema/RLS/policy/migration changes were introduced; the diff only updates workflow/docs and a guard script.
Runtime And Package Manager Integrity	✅ Passed	PASS: PR only adds a guard script and CI check; package.json still pins npm@11.17.0/Node 24.x, .npmrc keeps engine-strict=true, and CI still uses npm ci + package-lock.
Api Route Failure Handling	✅ Passed	PASS: The workflow now wraps issues.listComments in a 403-aware try/catch, soft-skips on auth failure, and rethrows non-403 errors; createComment is handled similarly.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: hardening the Codex auto-resolve review guard.
Description check	✅ Passed	The description follows the repository template with Summary, Verification, and Notes, and includes relevant validation steps.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/autoresolve-listcomments-403

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch codex/autoresolve-listcomments-403

_{Comment @coderabbitai help to get the list of available commands.}

supabase · 2026-07-09T11:16:36Z

Updates to Preview Branch (codex/autoresolve-listcomments-403) ↗︎

Deployments	Status	Updated
Database	✅	Thu, 09 Jul 2026 12:20:54 UTC
Services	✅	Thu, 09 Jul 2026 12:20:54 UTC
APIs	✅	Thu, 09 Jul 2026 12:20:54 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Thu, 09 Jul 2026 12:20:56 UTC
Migrations	✅	Thu, 09 Jul 2026 12:20:58 UTC
Seeding	✅	Thu, 09 Jul 2026 12:20:59 UTC
Edge Functions	✅	Thu, 09 Jul 2026 12:21:00 UTC

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

BigSimmo · 2026-07-09T11:20:22Z

@copilot resolve the merge conflicts in this pull request

coderabbitai · 2026-07-09T11:52:00Z

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 3 file(s) based on 3 unresolved review comments.

Files modified:

docs/branch-review-ledger.md
docs/codex-review-protocol.md
scripts/embed-registry-records.ts

Commit:73aab704169e6902481eb5ac5357a4f946849b22

The changes have been pushed to the codex/autoresolve-listcomments-403 branch.

Time taken:5m 24s

Fixed 3 file(s) based on 3 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

BigSimmo · 2026-07-09T12:11:29Z

@copilot resolve the merge conflicts in this pull request

Copilot · 2026-07-09T12:14:50Z

@copilot resolve the merge conflicts in this pull request

Resolved. Merge commit: f81bdc4

docs/codex-review-protocol.md, scripts/embed-registry-records.ts, src/lib/rag-routing.ts, src/lib/registry-corpus.ts, supabase/drift-manifest.json — accepted origin/main
docs/branch-review-ledger.md — kept branch's Prettier-formatted version

Typecheck and Prettier checks pass.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:ecd4fd4a0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

BigSimmoand others added 25 commits July 9, 2026 00:26

feat: add image generation metadata re-stamp script
f86ae20

chore: reconcile ingestion RPC execute privileges, schema.sql and dri…
bac1752
…ft manifest

ci: add db-reset-verify and dependency-review workflows
9216187

ci: remove dependency-review workflow because repository is private w…
83b437e
…ithout GHAS

Merge origin/main into claude/llm-pipeline-review
1eee7d8

Merge remote-tracking branch 'origin/claude/llm-pipeline-review' into…
50adfd5
… claude/llm-pipeline-review

📝 CodeRabbit Chat: Simplify code implementation (#434)
6b7e581
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

fix(db): rename duplicate migration version 20260708160000 to unique …
7efedc2
…20260708160001

fix: run prettier on 19 files to fix CI format:check failure (#436)
24314db

fix: address follow-up PR 433 review comments
255ca67
- Backfill NULL document_images.index_generation_id during re-stamp - Count globally forced embedding eval cases in retrieval summaries Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>

fix: address PR 433 review blockers
e811cc1

Merge origin/main into claude/llm-pipeline-review
d831252

Merge remote-tracking branch 'origin/claude/llm-pipeline-review' into…
a76fc39
… codex/pr433-fix

ci: keep supabase cache save non-blocking
e1b5407

Merge remote-tracking branch 'origin/claude/llm-pipeline-review' into…
6c06307
… codex/pr433-fix

ci: run migration verification before docker image cache save
93c70e3

fix: address registry corpus review comments
c424845

Finish RAG registry re-embed and quality routing (#438)
75ad728
* fix(rag): finish registry re-embed and quality routing * fix: resolve merge conflicts with claude/llm-pipeline-review --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

docs: codify review and branch cleanup workflow
3e64189

Merge remote-tracking branch 'origin/claude/llm-pipeline-review' into…
009e85c
… claude/llm-pipeline-review # Conflicts: # tests/rag-routing.test.ts

ci: soft-skip Codex autoresolve comment permission errors
fb382ee

Copilotstarted work on behalf of BigSimmo July 9, 2026 11:21 View session

merge: start resolving conflicts with origin/main
b40d991

auto-merge was automatically disabled July 9, 2026 11:50
Head branch was pushed to by a user without write access

Copilotfinished work on behalf of BigSimmo July 9, 2026 11:51

BigSimmo enabled auto-merge (squash) July 9, 2026 11:52

Copilotfinished work on behalf of BigSimmo July 9, 2026 11:52

fix: apply CodeRabbit auto-fixes
73aab70
Fixed 3 file(s) based on 3 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

Copilotstarted work on behalf of BigSimmo July 9, 2026 11:59 View session

Copilot stopped work on behalf of BigSimmo due to an error July 9, 2026 12:03
You have exceeded your monthly quota (Request ID: 304B:13FA42:451A8C9:4C7FE6C:6A4F8E08)

coderabbitaiBot previously approved these changes Jul 9, 2026
View reviewed changes

Copilotstarted work on behalf of BigSimmo July 9, 2026 12:06 View session

fix: format docs/branch-review-ledger.md to pass Prettier check
9130372

auto-merge was automatically disabled July 9, 2026 12:07
Head branch was pushed to by a user without write access

CopilotAI dismissed coderabbitai[bot]’s stale review via 9130372July 9, 2026 12:07

Copilotfinished work on behalf of BigSimmo July 9, 2026 12:07

Copilotstarted work on behalf of BigSimmo July 9, 2026 12:12 View session

coderabbitaiBot previously approved these changes Jul 9, 2026
View reviewed changes

merge: resolve conflicts with origin/main
f81bdc4

CopilotAI dismissed coderabbitai[bot]’s stale review via f81bdc4July 9, 2026 12:14

Copilotfinished work on behalf of BigSimmo July 9, 2026 12:15

fix: harden Codex auto-resolve review guard
ecd4fd4

BigSimmo enabled auto-merge (squash) July 9, 2026 12:20

BigSimmo changed the title ~~ci: soft-skip Codex autoresolve permission errors~~fix: harden Codex auto-resolve review guardJul 9, 2026

chatgpt-codex-connectorBot reviewed Jul 9, 2026
View reviewed changes

Comment threadscripts/check-codex-autofix-workflow.mjs

BigSimmo merged commit 230ec3f into mainJul 9, 2026
11 of 12 checks passed

BigSimmo deleted the codex/autoresolve-listcomments-403 branch July 9, 2026 12:42

coderabbitaiBot mentioned this pull request Jul 13, 2026
fix(ci): gate Codex auto-resolve on completed review and post as a non-bot user #610
Merged
5 tasks

coderabbitaiBot mentioned this pull request Jul 25, 2026
Bot branch-sync heads leave required checks unapproved (#082) #1235
Open

coderabbitaiBot mentioned this pull request Aug 12, 2026
chore(tooling): finalize tooling follow-through notes (#150 #151) #1836
Merged
5 tasks

Navigation Menu

fix: harden Codex auto-resolve review guard - #445

fix: harden Codex auto-resolve review guard#445
BigSimmo merged 33 commits into
mainfrom
codex/autoresolve-listcomments-403

BigSimmo commented Jul 9, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Jul 9, 2026•
edited
Loading

Walkthrough

Changes

Pre-merge checks failed

Uh oh!

supabaseBot commented Jul 9, 2026•
edited
Loading

Uh oh!

BigSimmo commented Jul 9, 2026

Uh oh!

coderabbitaiBot commented Jul 9, 2026•
edited
Loading

Uh oh!

BigSimmo commented Jul 9, 2026

Uh oh!

CopilotAI commented Jul 9, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

BigSimmo commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Notes

Uh oh!

coderabbitaiBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Pre-merge checks failed

❌ Failed checks (1 error, 1 warning)

Uh oh!

supabaseBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BigSimmo commented Jul 9, 2026

Uh oh!

coderabbitaiBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Fixes Applied Successfully

Uh oh!

BigSimmo commented Jul 9, 2026

Uh oh!

CopilotAI commented Jul 9, 2026

Uh oh!

chatgpt-codex-connectorBot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

BigSimmo commented Jul 9, 2026•
edited
Loading

coderabbitaiBot commented Jul 9, 2026•
edited
Loading

supabaseBot commented Jul 9, 2026•
edited
Loading

coderabbitaiBot commented Jul 9, 2026•
edited
Loading